Lazarus_Group__2020__securelist.com-Lazarus_covets_COVID-19-related_intelligence.pdf

Kaspersky describes two Lazarus-attributed intrusions targeting COVID-19-related organizations: a wAgent infection at a health ministry (in-memory loader, DLL injection, Security Support Provider persistence) and a Bookcode compromise of a vaccine-developing pharmaceutical firm (loader, injected backdoor, supply-chain/spearphishing vectors). The report documents post-exploitation actions (SAM dumps, network reconnaissance, lateral movement), lists C2 infrastructure and file/hash IOCs, maps techniques to MITRE ATT&CK, and concludes Lazarus is actively seeking COVID-19 research intelligence.